2026-09-21 · view entry permalink →
NightEagle (APT-Q-95) pivots to Russian targets, tunnels RDP through Microsoft's own legitimate dev-tunnels service, and DCSyncs domain credentials after exploiting BlueKeep
Kaspersky's Global Emergency Response Team documents a NightEagle (also tracked as APT-Q-95) campaign, active since at least 2023 and previously focused on Asian targets, now confirmed against organizations in Russia (Kaspersky Securelist, 2026-09-16). Initial access used compromised VPN credentials, with connections originating from IP addresses in the Russian segment linked to Cloudflare WARP tunnels, as well as from European VPS ranges. On Microsoft Exchange servers the group deploys the GhostContainer backdoor, a .NET assembly that incorporates the Neo-reGeorg tunnel, an exploit component for CVE-2020-0688, and the GhostWebShell class from the ysoserial utility; Kaspersky assesses with high confidence that delivery reused a technique it had already documented, extracting Exchange's own ASP.NET machine keys, then overwriting the VIEWSTATE framework parameter and injecting a payload into it to launch the backdoor in memory. Once running, the backdoor evades detection by patching addresses in amsi.dll and ntdll.dll, blinding both the Antimalware Scan Interface and Windows Event Logging.
For network access, NightEagle abuses Microsoft's own legitimate dev-tunnels feature (*.devtunnels.ms), a service meant to publish local developer web services to the internet, to expose port 3389 (RDP) outward on the compromised host, then layers rdp2tcp, a public RDP-virtual-channel TCP tunneling tool, inside that RDP session; a combination Kaspersky states lets the group maintain network access using legitimate services, without opening any additional suspicious port. Staged payloads on GitHub carry mismatched legitimate-sounding filenames (adobe_32.exe, 1c-office-plugin.exe, trueconf-broker.exe) to blend in with normal software update or business-communication traffic. For lateral movement and privilege escalation, NightEagle exploited CVE-2019-0708 (BlueKeep) in one incident to create and elevate a local account into the Administrators and Remote Desktop Users groups, used Impacket's atexec to set scheduled netsh portproxy rules for internal port forwarding, and requested Kerberos tickets carrying a non-standard Forwardable/Proxiable/Renewable flag combination before executing DCSync against the Domain-Password object to dump domain credentials by impersonating the domain controller.
Triage: Microsoft dev-tunnels traffic to *.devtunnels.ms is legitimate on developer workstations running Visual Studio or the Dev Tunnels CLI; the discriminator is the host class: a production server, domain controller, or non-developer endpoint establishing an outbound dev-tunnels connection has no legitimate reason to do so.
We have now identified attacks by the group targeting businesses in Russia.
This is a legitimate Microsoft mechanism that allows local web services to be published for internet access on ..devtunnels.ms domains. The attackers used this tunneling capability to expose port 3389 (RDP) on the compromised system.
In one incident, they exploited a well-known RDP implementation vulnerability, CVE-2019-0708 (BlueKeep). They used the vulnerable mechanism to create a local account on the system and add it to the Administrators and Remote Desktop Users groups.
The attackers also requested Kerberos tickets with a non-standard combination of flags (Forwardable, Proxiable, Renewable) and attempted to replicate the Domain-Password object from the Active Directory database to impersonate the domain controller (a technique known as DCSync) after obtaining an account with sufficient privileges.